PHP 5.3.26

NEWS

@@ -1,6 +1,10 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2013, PHP 5.3.26
+06 Jun 2013, PHP 5.3.26
+
+- Core:
+  . Fixed bug #64879 (Heap based buffer overflow in quoted_printable_encode,
+    CVE 2013-2110). (Stas)
 
 - Calendar:
   . Fixed bug #64895 (Integer overflow in SndToJewish). (Remi)
@@ -15,16 +19,16 @@ PHP                                                                        NEWS
     pointer has closed). (Laruence)
 
 - Phar
-  . Fixed bug #64214 (PHAR PHPTs intermittently crash when run on DFS, SMB or with
-    non std tmp dir). (Pierre)
+  . Fixed bug #64214 (PHAR PHPTs intermittently crash when run on DFS, SMB or 
+    with non std tmp dir). (Pierre)
 
 - Streams:
   . Fixed bug #64770 (stream_select() fails with pipes returned by proc_open()
     on Windows x64). (Anatol)
 
 - Zend Engine:
-  . Fixed bug #64821 (Custom Exception crash when internal properties overridden).
-    (Anatol)
+  . Fixed bug #64821 (Custom Exception crash when internal properties
+    overridden). (Anatol)
 
 09 May 2013, PHP 5.3.25
 

configure.in

@@ -42,7 +42,7 @@ AC_CONFIG_HEADER(main/php_config.h)
 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=3
 PHP_RELEASE_VERSION=26
-PHP_EXTRA_VERSION="-dev"
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
 

ext/standard/quot_print.c

@@ -151,7 +151,7 @@ PHPAPI unsigned char *php_quot_print_encode(const unsigned char *str, size_t len
 	unsigned char c, *ret, *d;
 	char *hex = "0123456789ABCDEF";
 
-	ret = safe_emalloc(1, 3 * length + 3 * (((3 * length)/PHP_QPRINT_MAXL) + 1), 0);
+	ret = safe_emalloc(3, length + (((3 * length)/(PHP_QPRINT_MAXL-9)) + 1), 1);
 	d = ret;
 
 	while (length--) {

ext/standard/tests/strings/bug64879.phpt

@@ -0,0 +1,12 @@
+--TEST--
+Bug #64879: quoted_printable_encode() wrong size calculation (CVE-2013-2110)
+--FILE--
+<?php
+
+quoted_printable_encode(str_repeat("\xf4", 1000)); 
+quoted_printable_encode(str_repeat("\xf4", 100000)); 
+
+echo "Done\n";
+?>
+--EXPECTF--	
+Done

main/php_version.h

@@ -3,6 +3,6 @@
 #define PHP_MAJOR_VERSION 5
 #define PHP_MINOR_VERSION 3
 #define PHP_RELEASE_VERSION 26
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "5.3.26-dev"
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "5.3.26"
 #define PHP_VERSION_ID 50326